fluent-plugin-aws-elasticsearch-service 2.1.0 → 2.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cebb1488546995a34d5c6cd9f019b5d29b4607a2a5067f97945b728c07779f12
-  data.tar.gz: 15c86bb134d81b1443eb775e9ec6948b055506d3dbd47a86294d0106de7720c6
+  metadata.gz: 5d84467ff7d53aaf3fd8b30bc85e7f9448593be039343b82afe787a1c4a4aae6
+  data.tar.gz: c0843971ac83c97da2999308412043ff099c48c1915fed1170c30c20b5ead286
 SHA512:
-  metadata.gz: a556f97f09ff229fdad4db491181a52045fbc45c52cf28134134bf0e2488746c052e6926ff7ea0988a7359569d246ef770f775800f113f3e4b1ae37e1ad8ac3f
-  data.tar.gz: 130a434abf6cee619873a61de9dde56f00ac6f3a1ea6ff69575cd100f0b63c97667ea04cde23c4e4f4d0e4b00ab12b761f1577fd4509995052acdc78fae9a254
+  metadata.gz: 29a91e7961c4f6eb7fd671c5dbc0710d5a45efaf84188b1a99f012342384f51db6b1434fb2bfe2f903c26540296610d3446a4570abe5926d44e988df55b6a40a
+  data.tar.gz: d93f4865d68fc05ec3b82d66872598d7769e108f143204b041649b91659e6763dd33c138ad3cf3467771e3348336f433a8f35a18345c8a8f3d9e7422592ccdd1

data/README.md

@@ -126,6 +126,20 @@ You'll need to ensure that the environment in which the fluentd plugin runs has
 }
 ```
 
+### EKS
+If you want to use IAM roles for service accounts on Amazon EKS clusters, please refer to the official documentation and specify a Service Account for your fluentd Pod.
+
+Then, the endpoint configuration looks like:
+
+```ruby
+<endpoint>
+  url https://CLUSTER_ENDPOINT_URL
+  region eu-west-1
+  assume_role_arn "#{ENV['AWS_ROLE_ARN']}"
+  assume_role_web_identity_token_file "#{ENV['AWS_WEB_IDENTITY_TOKEN_FILE']}"
+</endpoint>
+```
+
 ## Troubleshooting
 
 * "Elasticsearch::Transport::Transport::Errors::Forbidden" error="[403]" even after verifying the access keys/roles/policies.

data/fluent-plugin-aws-elasticsearch-service.gemspec

@@ -5,7 +5,7 @@ $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
 
 Gem::Specification.new do |spec|
   spec.name          = "fluent-plugin-aws-elasticsearch-service"
-  spec.version       = "2.1.0"
+  spec.version       = "2.2.0"
   spec.authors       = ["atomita"]
   spec.email         = ["sleeping.cait.sith+gh@gmail.com"]
 

data/lib/fluent/plugin/out_aws-elasticsearch-service.rb

@@ -15,10 +15,11 @@ module Fluent::Plugin
       config_param :region, :string
       config_param :url, :string
       config_param :access_key_id, :string, :default => ""
-      config_param :secret_access_key, :string, :default => ""
+      config_param :secret_access_key, :string, :default => "", secret: true
       config_param :assume_role_arn, :string, :default => nil
       config_param :ecs_container_credentials_relative_uri, :string, :default => nil #Set with AWS_CONTAINER_CREDENTIALS_RELATIVE_URI environment variable value
       config_param :assume_role_session_name, :string, :default => "fluentd"
+      config_param :assume_role_web_identity_token_file, :string, :default => nil
     end
 
     # here overrides default value of reload_connections to false because
@@ -84,11 +85,19 @@ module Fluent::Plugin
               }).credentials
             end
           else
-            credentials = sts_credential_provider({
-                            role_arn: opts[:assume_role_arn],
-                            role_session_name: opts[:assume_role_session_name],
-                            region: opts[:region]
-                          }).credentials
+            if opts[:assume_role_web_identity_token_file].nil?
+              credentials = sts_credential_provider({
+                              role_arn: opts[:assume_role_arn],
+                              role_session_name: opts[:assume_role_session_name],
+                              region: opts[:region]
+                            }).credentials
+            else
+              credentials = sts_web_identity_credential_provider({
+                              role_arn: opts[:assume_role_arn],
+                              web_identity_token_file: opts[:assume_role_web_identity_token_file],
+                              region: opts[:region]
+                            }).credentials
+            end
           end
         end
         raise "No valid AWS credentials found." unless credentials.set?
@@ -106,6 +115,11 @@ module Fluent::Plugin
       @sts ||= Aws::AssumeRoleCredentials.new(opts)
     end
 
+    def sts_web_identity_credential_provider(opts)
+      # AssumeRoleWebIdentityCredentials is an auto-refreshing credential provider
+      @sts ||= Aws::AssumeRoleWebIdentityCredentials.new(opts)
+    end
+
   end
 
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: fluent-plugin-aws-elasticsearch-service
 version: !ruby/object:Gem::Version
-  version: 2.1.0
+  version: 2.2.0
 platform: ruby
 authors:
 - atomita
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2019-03-04 00:00:00.000000000 Z
+date: 2019-10-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler